We had someone on the team looking at it, but our emphasis was on things that a consumer or service provider stack could screw up in software, not so much on the protocol itself. (Our analysis was also very, very casual; we wrote code for it, but we didn't have a project plan.)

The other thing that messes with you with OAuth is how closely OAuth resembles a lot of ad-hoc schemes that preceded it; many of them have been tested and analyzed to death, so it lulls you into a false sense of confidence.